Hacker News Reader

No, the ultra paranoid would buy two computers...

The ultra-ultra paranoid might use their popular and widely read blog - a blog which is almost certainly read by more than one or two people at the NSA - to post an enormous boat-load of misdirection that is nevertheless also helpful advice for people who are actually stuck attempting to secure Windows computers. Advice that happens to highlight what a nigh-impossible task that really is. (TEN rules? Good luck.)

I can't think of any reason for someone in Schneier's position to publicize his actual security arrangements at this time.

Then again, maybe he feels he has a duty, as a security expert, to use and thereby remain familiar with the most popular systems around.

>Then again, maybe he feels he has a duty, as a security expert, to use and thereby remain familiar with the most popular systems around.

I think this is the case for security experts like Schneier and Krebs. Most of the threats they're interested in affect Windows. Most of their readers run Windows. They would be a less useful resource if their first recommendation was always "ditch Windows" even if that's accurate.

Maybe he needs to use Windows but whether or not his single air-gap-ed computer runs Windows or not isn't going to determine whether he's going to be running Windows in general.

I don't know how maintaining a full off-Internet computer isn't much more extreme than switching OSes. If he is recommended an off-Internet machine, it seems clear he'd want to recommend the hard steps as well as the easy steps.

I mean, he says he's running open office so Linux should be able to work great for him.

"I can't think of any reason for someone in Schneier's position to publicize his actual security arrangements at this time."

Schneier is more and more about promoting Schneier. I can't imagine a reason why someone who is so concerned about security would provide details on exactly what they do security wise (that would be accurate at least) because the more information you have about someone's practices the easier it is to defeat those practices.

Not to mention the mere fact that he is so much a public figure now makes him much more likely a target which could negate many of the things he is trying to do.

He's not concerned primarily with his own security. His entire career has been about promoting good security practices.

Has he actually said that he isn't primarily concerned with his own security and he is willing to risk his security for the benefit of others?

Come on, he is doing one of the best jobs in the world educating him about security. No, he probably wont risk his security for the benefit of others but he is a positive force. So please stop holding him to the absurd standards.

He is educating himself about security? This may actually be a tautology. :)

By the way, how many of you guys have read his books? Having actually read Applied Cryptography, I felt his contribution to this field was very little.

Well, that was obviously a typo. There are generation of new knowledge and dissemination of old knowledge. I am not quailified to comment on the first, however his contribution to the second is substantial.

How exactly is it substantial? I felt he mostly says things along the lines of, "oh, here is the 3-DES algorithm." But there is no commentary after it. Queestions like why is 3-DES structured so, or what are these fields are not explained at all. To me, it says that he doesn't really know how 3-DES works at all. Or, another case I remember is the simple password protection scheme in ZIP. He says that the three keys are initialized with these three values (which can be found in the PKZIP app readme). Then he goes on to claim that it is not secure and that cryptographers can break it easily. But how would start to do it is not explained at all. Why even mention what these three keys are initialized with? It was a disappointing book.

I felt he did not even disseminate old knowledge because he does not know/comprehend old knowledge. He just disseminated old predicates.

> I can't think of any reason for someone in Schneier's position to publicize his actual security arrangements at this time.

Why not? He's the last person I'd expect to rely on security through obscurity.

When the attack vector is literally relying on information disparities (previously unknown exploits), "obscurity" does provide a fair amount of security. If everyone thinks you're running Linux+OpenOffice and spends time writing looking for exploits there, but you're really running BeOS+Pe, that gives you a significant upper hand.

One of the few constants in security, "Security through obscurity is no security at all"

I literally gave you one example where that helped. Stuxnet and others are further evidence.

Simplified scenario: Your target will open a single file from you. How do you exploit them?

Very good point.

Im inclined to believe Scheiers real security arrangemetns are obscured for now.

That's false. If you're talking exclusively about startups it may be true but that's only because maintaining obscurity isn't an option.

I'm surprised how often that's repeated given that it's not true at all. Obscurity is a totally legitimate security technique. Maybe not the strongest one, and hopefully not your only defense, but it's clearly got some value.

The fundamental misunderstanding that has developed is that there are "systems which are secure", and "systems which are not secure". This is false. Security can be thought of as "how long it will take for Attacker A to compromise this system". All systems can be compromised eventually.

Thus clearly security through obscurity is a valid tactic to increase security. You just have to regularly alter your structure based on how quickly your attackers work- but this is no different from any other form of security. All forms of security have a time limit...

In this particular case, Schneier can honestly, with 100% accuracy assume that he is being monitored. This is not paranoia - he has publicly stated that he has some of the Snowden documents. And as we've seen in this saga, the people in power are doing anything and everything they can to get to them. (Miranda case, Guardian UK hard drive destruction, ...)

Under constant and potentially aggressive surveillance, there is not much room for obscurity.

As to his using Windows - well, there may be good reason for that. Schneier has been using Windows for a very long time, and with his level of sophistication, I expect him to be rather good at digging in to the system and identifying potentially unwanted behaviour. This should make NSA less likely to deploy some of their highest-value tools, because it is probable that the tools used would be exposed.

Assuming he is less well versed in maintaining and excavating a Linux installation, it would be more likely for the machine to get silently infected by a zero-day, high-octane exploit.

After all: prevention is desirable, detection is crucial. (How else could you contain the damage once it happens?)

Well I use it as the counterargument to "open source software is full of holes because bad guys can read the source". Because everyone knows that Microsoft doesn't publish their source code and has never been exploited ever.

My point was simply that obsfucation will barely even slow down a determined attacker, ESPECIALLY one with the resources of a nation state (such as the US). It won't even register as a speed bump to anything other than a script kiddie or a worm designed for the majority case.

I'm really kind of shocked that my previous comment was voted -1, when the numbers blatantly agree with me on closed source vendors getting the living snot hacked out of them, even if their source is "obscured" due to not being available.

That's why no real systems use obscure strings of characters as authentication tokens.

Right?

You are misinterpreting 'obscurity' to as much of a degree as the grandparent post, though in a different way. The 'obscurity' that the adage speaks of is meant to relae to the system you're using. ROT13 is security through obscurity: as soon as your adversary knows you're using it, your system is broken. RSA is not security through obscurity: you can advertise that you use it (indeed, that's fundamentally a part of public key crypto), and still be safe.

> still be safe

Less safer than you earlier were. I think the whole point is that security is not a binary variable but a matter of degree.

> and he is using Windows !? WTF. He is going against his own advice - to use public/free software as often as possible.

It is weird, but I saw it coming. He has always used Windows. Back early 2000s it was because that was what his company was standardized on, and that was to make things simplest software distribution-wise. They did network security solutions (consulting-style, IIRC) and it may have been it was easiest to match their clients. I take it he hasn't bothered to migrate since then.

I'm curious to know which version of Windows, but I kind of assume it will be 7. XP was too security-poor, Win8 is too new. Security people who use Windows tend to lag major revs by a little (like most software releases).

For the record, the irony here isn't that a security guy is using Windows, it's that he's using Windows for security as he reports on deliberately backdoored commercial software.

What's wrong with using Windows for this? If the machine is air-gapped, you could run as antiquated or insecure system as you like. Windows seems perfectly practical and it's easy to obtain a DVD install for it.

The critical thing is to ensure you don't ever transfer nasty stuff to the machine. For the true paranoid, this means you are facing potential NSA zero-day vulnerabilities and such, so you could have the most patched version of Linux or Windows and still be at risk.

Now, it still makes sense to start with a good system, but the weakness here, whatever your OS, is the trustworthiness of the data you transfer to it on USB.

An air gap is just one layer of security.

Not knowing if there are code exec backdoors, intentional or otherwise, in your kernel: a whole different ballgame.

Schneier should know better.

or he knows that NSA can own both Windows and Linux. Which is probably true. At which point, he needs to 1) know his system is not yet owned and 2) that the encryption system he uses works and isn't backdoored.

So about his only plausibly concern is if Truecrypt uses the Window's entropy pool switched to use say EC_DAUL_DRBG. That is a concern, but it's one with Truecrypt and can be checked.

This is assuming that even for the NSA, having Window's identify and modify the truecrypt binary is impossible. Realistically, if you are worrying about that, you should worry about Intel chips doing the same thing. At which point, you're screwed no matter what OS you use.

Would add to this that he is in a sense a high value target by the fact that he is well known and has an agenda which others may not approve of.

What might not be practical or possible with "anyone" becomes "possible" with a high value target. [1]

I'm remembering back to OJ Simpson case back in the early 90's. The police did things to try to pin the crime on him (searching trashdumps) that they simply don't do or don't have the resources to do in ordinary cases. (They found nothing but they tried and went to an extraordinary effort to try and find some evidence against OJ.)

[1] I'm wondering for example where physically the air gapped computer is kept and the physical security and/or alarms around that computer.

Physical security is the least of his problems. You can mount a lot of tempest[0]/ attacks from across the street.

http://en.wikipedia.org/wiki/Tempest_(codename)

And -you- would know that your open source OS does not have backdoors and zero-day vulnerabilities and such?

Don't be silly.

So what if they can't access those?

Who is "they" and what are "those"?

Is "those" referring to zero-day vulnerabilities?

You realize that a zero-day vulnerability means "they" accessed "those," right?

For one thing, Windows has all these standard "auto-run" systems that enable infection through simply inserting media.

>For the NSA-agent wishing to leak, a good idea is too look into HaikuOS, MenuetOS etc and use those instead of GNU/Linux, or ArchHurd. Something very rare, something unexpected.

Is that really the best idea, though? One of the things Linux has going for it is a couple of decades worth of public scrutiny and hardening.

The suggestion is that hardening is less valuable than obscurity. As long as your choice is secret and uncommon you'll probably be safer than a well known hardened OS.

And thats why Schneier probably isnt using Windows but its a diversion. Takes tinfoil hat off.

The attackers are NSA.

It is stupid to think that obscuring the OS would delay them by any more than a couple of hours at best.

On an air-gapped machine? How would they determine the OS, so long you're careful about how the files you export are written? The article rules out TEMPEST and physical attacks.

How would they know if it's not on the internet?

If Intel have put a backdoor in then the OS does not matter.

He also claims that it's impossible to avoid connecting to the Internet. Which is of course not true; there's no reason he couldn't just boot an OS installer (or the entire OS, like Tails which he mentions) from an optical disc, or another media. Which is precisely what he will do unless he thinks it's a good idea to boot and connect the pre-installed, unpatched, crapware-loaded copy of Windows...

Actually, the "ultra paranoid" would live in a cave without computers.

You didn't really explain what was wrong with using Windows.

Don't be like, "Jesus christ, and he is using Windows !? WTF." without explaining why using Windows is insecure, and how the other OSes you claim will be any better.

Don't think that because you're not using Windows you are secure. If a well-funded entity wants what you have, they will get it.

Schneier, IMHO, is paranoid for no reason. I'd lay a wager that the US government cares very little about him or his air-gapped systems (lol). He just wants to be heard.

I've been wondering why the government is supposedly so interested in what Schneier is doing.

Because he's working with the Guardian, helping them interpret the Snowden documents.

http://www.theguardian.com/profile/bruceschneier

http://www.technologyreview.com/news/519336/bruce-schneier-n...

I see. I'm going to have to assume that this article is complete misdirection in that case. He probably uses Linux on a 486 from Kazakhstan.

I'm not really sure the government is interested. But Schneier seems to think they are though.

I take it you use Windows..

Windows is known to be deliberately backdoored. Schneier has publicly stated he's got the Snowden documents, and has been reporting on them for the Guardian. I can't think of a better need for an airgapped machine. On what planet would he not be being heavily surveiled?

Next you'll be saying Snowden is a fantasist too.

I use all OSes. And it matters _very_ little what OS you use. All that matters is how much resource your adversary is willing to expend to get at what it wants.

And can you back up your claim of Windows being deliberately backdoored? My third statement in this post makes this point moot, too.

RE: Schneier having Snowden documents, I don't know if Schneier's cleared or has access to compartments to view them. If he does not, people would arrive at his doorstep to confiscate them. And since we have not heard Schneier saying MIB have come to his door (which trust me he would since he's a publicity hog) leads me to believe that the US government cares _very_ little for him.

Jesus christ, and he is using Windows !? WTF.

Exactly. He's not using any applications that won't run on Linux (or one of the BSDs, or even OS X for that matter).

No, the ultra paranoid would buy two computers, perform install 1 from friend 1s internet connection, downloading everything keeping a copy and check-sums, then perform install 2 on a friend of a friends connection, then compare the results of both the downloaded check-sums and the installation. (For certain flavors of Linux it should be the same).

Because the NSA would have no idea who your friends are, and wouldn't dream of monitoring their internet connections.

He forgot to say that you must encrypt the entire usb-stick as well

Rule-10 says to consider encrypting everything you transfer. (How do you "write an encrypted blob" to a USB disk without using a filesystem, on a normal computer that you aren't writing your own fake-filsystem driver on, than you can also read on an internet connected computer, e.g. one at your friend's house?).

What makes you think you need a file system or partition table for a block device? Please tell me, because I know, you don't need any.

I don't think you need a filesystem of partition table to put data on a block device.

I think you need a filesystem if you are in the world of Bruce Schneier's article, using Windows on both sides, writing at the level where "don't connect your air-gap computer to the internet" is worth saying.

Of course you can C-x M-c M-butterfly[1] this scenario, increasing impracticality more than security at every step, as far as you find enjoyable.

[1] http://xkcd.com/378/

> Jesus christ, and he is using Windows !? WTF. He is going against his own advice - to use public/free software as often as possible.

I can think of a few reasons why that might be reasonable, but I agree that the advise could be better.

1. He IS using Linux/BSD/similar, but has changed the article to Windows to be useful to Windows users and/or add some obscurity to his setup. 2. More familiar with Windows security practices, so more confident in overall security by using Windows (not that really helps with 0days or NSA backdoors though) 3. He has NSA docs that show Linux is compromised in some way and Windows isn't (seems unlikely TBH).

That said, it does seem very odd to stick with Windows if you feel it necessary to air-gap the machine.